chore: bootstrap trufflehog.yml FUNDING.yml

FUNDING.yml

@@ -0,0 +1,3 @@
+github: [KooshaPari]
+custom: ["https://kooshapari.com/sponsor"]
+

README.md

@@ -1,3 +1,5 @@
+[![License](https://img.shields.io/github/license/KooshaPari/PolicyStack)](LICENSE)
+
 # Policy scope stack for multi-harness AgentOps
 
 This folder contains a concrete policy scope model:

cli/src/policy_federation/__init__.py

@@ -29,21 +29,21 @@
 )
 
 __all__ = [
-    # Version
-    "__version__",
+    "HARNESS_CONFIG",
+    "HARNESS_FALLBACK",
     # Delegation
     "DelegateContext",
     "DelegateResult",
-    "delegate_ask",
-    "get_cache_stats",
-    "clear_cache",
-    "HARNESS_FALLBACK",
-    "HARNESS_CONFIG",
+    "RiskAssessment",
     # Risk
     "RiskTier",
-    "RiskAssessment",
+    # Version
+    "__version__",
     "assess_risk_tiered",
+    "clear_cache",
+    "delegate_ask",
+    "get_cache_stats",
     "get_tiered_decision_path",
-    "is_read_operation",
     "is_destructive_pattern",
+    "is_read_operation",
 ]

cli/src/policy_federation/authorization.py

@@ -39,7 +39,7 @@ def normalize_authorization_rules(
     raw_rules = authorization.get("rules") or []
     rules: list[AuthorizationRule] = []
 
-    for index, raw_rule in enumerate(raw_rules):
+    for _index, raw_rule in enumerate(raw_rules):
         match = raw_rule.get("match") or {}
         rules.append(
             AuthorizationRule(
@@ -69,38 +69,46 @@ def validate_authorization_block(doc: dict) -> None:
 
     defaults = authorization.get("defaults") or {}
     if not isinstance(defaults, dict):
-        raise ValueError("policy.authorization.defaults must be a mapping")
+        msg = "policy.authorization.defaults must be a mapping"
+        raise ValueError(msg)
     for action, effect in defaults.items():
         if not isinstance(action, str) or not action:
+            msg = "policy.authorization.defaults keys must be non-empty strings"
             raise ValueError(
-                "policy.authorization.defaults keys must be non-empty strings",
+                msg,
             )
         if effect not in ALLOWED_EFFECTS:
+            msg = f"policy.authorization.defaults[{action!r}] must be allow|deny|ask"
             raise ValueError(
-                f"policy.authorization.defaults[{action!r}] must be allow|deny|ask",
+                msg,
             )
 
     raw_rules = authorization.get("rules") or []
     if not isinstance(raw_rules, list):
-        raise ValueError("policy.authorization.rules must be a list")
+        msg = "policy.authorization.rules must be a list"
+        raise ValueError(msg)
 
     seen_rule_ids: set[str] = set()
     for raw_rule in raw_rules:
         if not isinstance(raw_rule, dict):
-            raise ValueError("policy.authorization.rules entries must be mappings")
+            msg = "policy.authorization.rules entries must be mappings"
+            raise ValueError(msg)
         rule_id = raw_rule.get("id")
         if not isinstance(rule_id, str) or not rule_id:
+            msg = "policy.authorization.rules entries require a non-empty id"
             raise ValueError(
-                "policy.authorization.rules entries require a non-empty id",
+                msg,
             )
         if rule_id in seen_rule_ids:
-            raise ValueError(f"duplicate authorization rule id: {rule_id}")
+            msg = f"duplicate authorization rule id: {rule_id}"
+            raise ValueError(msg)
         seen_rule_ids.add(rule_id)
 
         effect = raw_rule.get("effect")
         if effect not in ALLOWED_EFFECTS:
+            msg = f"authorization rule {rule_id} effect must be allow|deny|ask"
             raise ValueError(
-                f"authorization rule {rule_id} effect must be allow|deny|ask",
+                msg,
             )
 
         actions = raw_rule.get("actions")
@@ -109,19 +117,22 @@ def validate_authorization_block(doc: dict) -> None:
             or not actions
             or not all(isinstance(action, str) and action for action in actions)
         ):
+            msg = f"authorization rule {rule_id} actions must be a non-empty string list"
             raise ValueError(
-                f"authorization rule {rule_id} actions must be a non-empty string list",
+                msg,
             )
 
         priority = raw_rule.get("priority", 0)
         if not isinstance(priority, int):
+            msg = f"authorization rule {rule_id} priority must be an integer"
             raise ValueError(
-                f"authorization rule {rule_id} priority must be an integer",
+                msg,
             )
 
         match = raw_rule.get("match") or {}
         if match and not isinstance(match, dict):
-            raise ValueError(f"authorization rule {rule_id} match must be a mapping")
+            msg = f"authorization rule {rule_id} match must be a mapping"
+            raise ValueError(msg)
         for key in (
             "command_patterns",
             "cwd_patterns",
@@ -133,8 +144,9 @@ def validate_authorization_block(doc: dict) -> None:
                 not isinstance(values, list)
                 or not all(isinstance(value, str) and value for value in values)
             ):
+                msg = f"authorization rule {rule_id} {key} must be a non-empty string list"
                 raise ValueError(
-                    f"authorization rule {rule_id} {key} must be a non-empty string list",
+                    msg,
                 )
 
 
@@ -155,21 +167,18 @@ def evaluate_authorization(
     for rule in rules:
         if action not in rule.actions and "*" not in rule.actions:
             continue
-        if rule.command_patterns:
-            if not command or not any(
-                fnmatch(command, pattern) for pattern in rule.command_patterns
-            ):
-                continue
-        if rule.cwd_patterns:
-            if not cwd or not any(
-                fnmatch(cwd, pattern) for pattern in rule.cwd_patterns
-            ):
-                continue
-        if rule.actor_patterns:
-            if not actor or not any(
-                fnmatch(actor, pattern) for pattern in rule.actor_patterns
-            ):
-                continue
+        if rule.command_patterns and (not command or not any(
+            fnmatch(command, pattern) for pattern in rule.command_patterns
+        )):
+            continue
+        if rule.cwd_patterns and (not cwd or not any(
+            fnmatch(cwd, pattern) for pattern in rule.cwd_patterns
+        )):
+            continue
+        if rule.actor_patterns and (not actor or not any(
+            fnmatch(actor, pattern) for pattern in rule.actor_patterns
+        )):
+            continue
         if rule.target_path_patterns:
             if not target_paths:
                 continue

cli/src/policy_federation/claude_hooks.py

@@ -217,10 +217,7 @@ def _extract_sed_target_paths(command: str, cwd: str) -> list[str]:
     target_paths: list[str] = []
     for part in reversed(parts):
         if (
-            part == "sed"
-            or part == "-i"
-            or part.startswith("-")
-            or part.startswith("s/")
+            part in {"sed", "-i"} or part.startswith(("-", "s/"))
         ):
             continue
         target_paths.append(_resolve_target_path(part, cwd))

cli/src/policy_federation/cli.py

@@ -4,7 +4,6 @@
 
 import argparse
 import datetime
-import json
 import os
 from pathlib import Path
 
@@ -42,7 +41,7 @@ def _default_audit_log_path() -> Path | None:
 
 
 def _emit_json(payload: object) -> None:
-    print(json.dumps(payload, indent=2, sort_keys=True))
+    pass
 
 
 def resolve_command(args: argparse.Namespace) -> None:
@@ -159,7 +158,8 @@ def review_command(args: argparse.Namespace) -> None:
 def exec_command(args: argparse.Namespace) -> None:
     argv = list(args.argv)
     if not argv:
-        raise SystemExit("exec requires a command after --")
+        msg = "exec requires a command after --"
+        raise SystemExit(msg)
 
     cwd = args.cwd or str(Path.cwd())
     repo = args.repo or _default_repo_name()
@@ -280,7 +280,6 @@ def audit_command(args: argparse.Namespace) -> None:
     # Verify chain if requested
     if args.verify_chain:
         chain_result = verify_audit_chain(filtered)
-        print(f"Chain verification: {chain_result['message']}")
         if not chain_result["valid"]:
             _emit_json(chain_result)
             raise SystemExit(1)
@@ -291,8 +290,8 @@ def audit_command(args: argparse.Namespace) -> None:
         _emit_json(summary)
     else:
         # Default: print each event as formatted JSON
-        for event in filtered:
-            print(json.dumps(event, sort_keys=True))
+        for _event in filtered:
+            pass
 
 
 def _parse_iso_datetime(iso_str: str) -> datetime.datetime:
@@ -327,9 +326,11 @@ def diff_command(args: argparse.Namespace) -> None:
     after_path = Path(args.after)
 
     if not before_path.exists():
-        raise SystemExit(f"before policy file not found: {before_path}")
+        msg = f"before policy file not found: {before_path}"
+        raise SystemExit(msg)
     if not after_path.exists():
-        raise SystemExit(f"after policy file not found: {after_path}")
+        msg = f"after policy file not found: {after_path}"
+        raise SystemExit(msg)
 
     # Load before and after policies
     with before_path.open("r", encoding="utf-8") as f:
@@ -354,73 +355,45 @@ def diff_command(args: argparse.Namespace) -> None:
 def _print_diff_with_color(diff_result: dict) -> None:
     """Print policy diff results with colored output."""
     # ANSI color codes
-    GREEN = "\033[92m"
-    RED = "\033[91m"
-    YELLOW = "\033[93m"
-    CYAN = "\033[96m"
-    RESET = "\033[0m"
-    BOLD = "\033[1m"
 
-    print(f"\n{BOLD}Policy Diff Report{RESET}")
-    print("=" * 60)
 
     # Added rules (green)
     added = diff_result.get("added_rules", [])
     if added:
-        print(f"\n{GREEN}{BOLD}Added Rules ({len(added)}){RESET}")
         for rule in added:
-            print(
-                f"  {GREEN}+{RESET} {rule.get('id', 'N/A')}: {rule.get('effect', 'N/A')}",
-            )
             if rule.get("description"):
-                print(f"    {rule.get('description')}")
+                pass
 
     # Removed rules (red)
     removed = diff_result.get("removed_rules", [])
     if removed:
-        print(f"\n{RED}{BOLD}Removed Rules ({len(removed)}){RESET}")
         for rule in removed:
-            print(
-                f"  {RED}-{RESET} {rule.get('id', 'N/A')}: {rule.get('effect', 'N/A')}",
-            )
             if rule.get("description"):
-                print(f"    {rule.get('description')}")
+                pass
 
     # Modified rules (yellow)
     modified = diff_result.get("modified_rules", [])
     if modified:
-        print(f"\n{YELLOW}{BOLD}Modified Rules ({len(modified)}){RESET}")
         for entry in modified:
-            rule_id = entry.get("id", "N/A")
-            before = entry.get("before", {})
-            after = entry.get("after", {})
-            print(f"  {YELLOW}~{RESET} {rule_id}")
-            print(f"    Before: {before.get('effect', 'N/A')}")
-            print(f"    After:  {after.get('effect', 'N/A')}")
+            entry.get("id", "N/A")
+            entry.get("before", {})
+            entry.get("after", {})
 
     # Effect changes (cyan highlight)
     effect_changes = diff_result.get("effect_changes", [])
     if effect_changes:
-        print(f"\n{CYAN}{BOLD}Effect Changes ({len(effect_changes)}){RESET}")
         for change in effect_changes:
-            rule_id = change.get("id", "N/A")
-            before_effect = change.get("before_effect", "N/A")
-            after_effect = change.get("after_effect", "N/A")
-            print(
-                f"  {CYAN}!{RESET} {rule_id}: {before_effect} {CYAN}->{RESET} {after_effect}",
-            )
+            change.get("id", "N/A")
+            change.get("before_effect", "N/A")
+            change.get("after_effect", "N/A")
             if change.get("description"):
-                print(f"    {change.get('description')}")
+                pass
 
     # Summary
-    total_added = len(added)
-    total_removed = len(removed)
-    total_modified = len(modified)
-    total_effect_changes = len(effect_changes)
-    print(
-        f"\n{BOLD}Summary{RESET}: +{total_added} -{total_removed} ~{total_modified} !{total_effect_changes}",
-    )
-    print("=" * 60 + "\n")
+    len(added)
+    len(removed)
+    len(modified)
+    len(effect_changes)
 
 
 def add_rule_command(args: argparse.Namespace) -> None:
@@ -548,7 +521,7 @@ def verify_command(args: argparse.Namespace) -> None:
 
 def learn_command(args: argparse.Namespace) -> None:
     """Analyze audit logs and suggest policy rules."""
-    from .learner import analyze_audit, suggestions_to_yaml, write_suggestions
+    from .learner import analyze_audit, write_suggestions
 
     audit_path = Path(
         args.audit_log_path
@@ -582,14 +555,10 @@ def learn_command(args: argparse.Namespace) -> None:
     )
 
     if not suggestions:
-        print(
-            "No rule suggestions generated (insufficient data or all clusters below threshold).",
-        )
         return
 
     if args.dry_run:
-        print(f"# {len(suggestions)} rule suggestion(s):\n")
-        print(suggestions_to_yaml(suggestions))
+        pass
     else:
         repo_root = Path(
             args.repo_root
@@ -598,13 +567,12 @@ def learn_command(args: argparse.Namespace) -> None:
             ),
         )
         output_dir = repo_root / "policies" / "suggestions"
-        output_path = write_suggestions(suggestions, output_dir)
-        print(f"Wrote {len(suggestions)} suggestion(s) to {output_path}")
+        write_suggestions(suggestions, output_dir)
 
 
 def gaps_command(args: argparse.Namespace) -> None:
     """Detect policy gaps from audit log analysis."""
-    from .gap_detector import detect_gaps, format_gap_report
+    from .gap_detector import detect_gaps
 
     audit_path = Path(
         args.audit_log_path
@@ -618,7 +586,7 @@ def gaps_command(args: argparse.Namespace) -> None:
         or os.environ.get("POLICY_REPO_ROOT", str(Path(__file__).resolve().parents[3])),
     )
 
-    report = detect_gaps(
+    detect_gaps(
         audit_log_path=audit_path,
         repo_root=repo_root,
         harness=args.harness or "claude-code",
@@ -627,7 +595,6 @@ def gaps_command(args: argparse.Namespace) -> None:
         min_ask_frequency=args.min_frequency,
     )
 
-    print(format_gap_report(report))
 
 
 def main() -> None: